After having a second look I noticed that there is only a per-forum setting whether moderators can bypass the attachment limits. But there is no global setting for attachments to private messages. That's why I committed a fix that removes the moderator check here. However, I am not sure that this is the correct way to do it.